UBUNTU-CVE-2026-98114: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ksmbd: propagate DACL parsing errors parsedacl() silently accepts truncated ACEs and allocation failures, allowing setinfosec() to continue with an incomplete ACL conversion. Return parsing and allocation errors to parsesecdesc() so malformed security descriptors are rejected before inode attributes or ACL xattrs are updated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Propagate parse_dacl() parsing and allocation errors to parse_sec_desc(), and reject malformed security descriptors before set_info_sec() updates inode attributes or ACL xattrs.
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs privileges to perform the relevant SMB security-descriptor update through ksmbd. The issue does not require user interaction or special attack conditions, but it is not exploitable by an unauthenticated user according to the provided vector.
What is the practical impact of a successful exploit?
A malformed security descriptor can be accepted and lead to incomplete ACL conversion before inode attributes or ACL extended attributes are updated. The stated impact is limited to integrity and confidentiality; no availability impact is indicated.
Which Ubuntu kernel packages are in scope?
The affected software list includes ubuntu/linux, ubuntu/linux-realtime, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, ubuntu/linux-riscv, and ubuntu/linux-gkeop.
How can I determine whether systems may be exposed?
Review systems running one of the listed Ubuntu kernel packages and determine whether ksmbd is in use for SMB service operations that allow security-descriptor updates. Systems not using ksmbd for these operations are not exposed through the described path.